deps: upgrade npm to 11.0.0

[npm-cli-bot]

11.0.0 (2024-12-16)

Documentation

• 8a911da #7963 ls: removed design change pending section note (#7963) (@milaninfy)

Dependencies

• 5319e48 #7973 remove unnecessary sprintf-js files in node_modules (#7973)
• d369c77 #7976 socks-proxy-agent@8.0.5
• 3b2951a #7976 https-proxy-agent@7.0.6
• a598b7b #7976 agent-base@7.1.3
• 52bcaf6 #7976 debug@4.4.0
• aabf345 #7976 p-map@7.0.3
• 28e8761 #7976 npm-package-arg@12.0.1

Chores

• ecd7190 #7976 dev dependency updates (@wraithgar)
• a07f4e0 #7976 @npmcli/template-oss@4.23.6 (@wraithgar)
• 687ab12 #7970 remove pre-release mode from npm 11 and workspaces (#7970) (@wraithgar)
• workspace: @npmcli/arborist@9.0.0
• workspace: @npmcli/config@10.0.0
• workspace: libnpmaccess@10.0.0
• workspace: libnpmdiff@8.0.0
• workspace: libnpmexec@10.0.0
• workspace: libnpmfund@7.0.0
• workspace: libnpmorg@8.0.0
• workspace: libnpmpack@9.0.0
• workspace: libnpmpublish@11.0.0
• workspace: libnpmsearch@9.0.0
• workspace: libnpmteam@8.0.0
• workspace: libnpmversion@8.0.0

[nodejs-github-bot]

Review requested:

• @nodejs/security-wg

[github-actions]

Fast-track has been requested by @nodejs-github-bot. Please 👍 to approve.

[wraithgar]

Breaking change list

• npm now supports node ^20.17.0 || >=22.9.0
• Upon publishing, in order to apply a default "latest" dist tag, the command now retrieves all prior versions of the package. It will require that the version you're trying to publish is above the latest semver version in the registry, not including pre-release tags.
• When publishing a package with a pre-release version, you must explicitly specify a tag.
• npm init now has a type prompt, and sorts the entries the created packages differently
• The npm hook command has been removed
• Attestations made by this package will no longer validate in npm versions prior to 10.6.0
• bun.lockb files are now included in the strict ignore list during packing
• --ignore-scripts now applies to all lifecycle scripts, include prepare
• npm will no longer fall back to the old audit endpoint if the bulk advisory request fails.
• npm will no longer switch to global mode if aliased to "npmg" or "npm-g" etc.

[wraithgar]

Just so we are clear, this is a breaking change! This should not be backported to node 22 (at least not without a good discussion first).

[wraithgar]

Why don't land on v23? I thought that's where breaking changes landed.

[ljharb]

I might be wrong, but v23 is already released, and main is v24, and breaking changes to non-experimental things can't land in an existing major. Anyone is of course free to remove the label if my understanding is correct.

[wraithgar]

Based on past discussions:

• Stop updating npm with breaking update in LTS Release#825
• Plans for npm 10 Release#884
• doc: add policy for executables #51994

It was only "LTS" that was the concern.

Additionally, given the "integrating with node" outline, nothing in this release breaks anything in that list.

[richardlau]

Why don't land on v23? I thought that's where breaking changes landed.

No, 23 follows semver like all Node.js releases. The odd releases have much shorter life times than the even ones, that become LTS. It's been a long-standing mismatch between npm's release policy and Node.js' policy and the compromise, in all of those linked issues, is that we would take a semver major npm version during a release line if it could be demonstrated that the breaking changes were not breaking to users.

[wraithgar]

👍 ok thanks for the clarification. We'll let you decide how far back to backport this.

The only things this will affect for folks running npm install would be:

• folks who are using it with --ignore-scripts but also still expecting prepare to run (i.e. with git dependencies)
• folks who somehow have a server they are using that supports its own audit endpoint, but only the fallback one
• folks who have a (useless) bun.lockb file they are expecting to show up in their published package

[ljharb]

Of those three, only the first one seems even remotely likely to be a concern, and a pretty unlikely one at that.

[nodejs-github-bot]

CI: https://ci.nodejs.org/job/node-test-pull-request/64074/